critical9.8
CVE-2019-8459
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path.
Impact
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Checkpoint | Jumbo Hotfix For Endpoint Security Server | before r77.30 |
| Checkpoint | Endpoint Security Server Package | before r77.30.03 |
| Checkpoint | Smartconsole For Endpoint Security Server | before r77.30.03 Version e80.83 |
| Checkpoint | Endpoint Security Clients | before e80.83 |
| Checkpoint | Remote Access Clients | before e80.83 |
| Checkpoint | Capsule Docs Standalone Client | before e80.82 |